diff --git a/src/demo/demoAuthClient.test.ts b/src/demo/demoAuthClient.test.ts
index cec3266..483ce3a 100644
--- a/src/demo/demoAuthClient.test.ts
+++ b/src/demo/demoAuthClient.test.ts
@@ -132,7 +132,7 @@ describe('demoAuthClient', () => {
             await expect(auth.getCurrentUser()).rejects.toThrow();
         });
 
-        it("fetchAuthSession resolves cognito:groups from the stored user's role", async () => {
+        it("fetchAuthSession resolves groups from the stored user's role", async () => {
             authGetStoredAuth.mockReturnValue({
                 accessToken: 'a',
                 refreshToken: 'r',
@@ -142,7 +142,7 @@ describe('demoAuthClient', () => {
 
             const session = await auth.fetchAuthSession();
 
-            expect(session.tokens?.accessToken?.payload['cognito:groups']).toEqual(['admin']);
+            expect(session.groups).toEqual(['admin']);
         });
 
         it('fetchAuthSession resolves no admin group for a non-admin user', async () => {
@@ -155,7 +155,7 @@ describe('demoAuthClient', () => {
 
             const session = await auth.fetchAuthSession();
 
-            expect(session.tokens?.accessToken?.payload['cognito:groups']).toEqual([]);
+            expect(session.groups).toEqual([]);
         });
 
         it('signOut delegates to authClient.logout', async () => {
diff --git a/src/demo/demoAuthClient.ts b/src/demo/demoAuthClient.ts
index 98e6d85..b73a35f 100644
--- a/src/demo/demoAuthClient.ts
+++ b/src/demo/demoAuthClient.ts
@@ -7,10 +7,9 @@
  * the server-backed `../api/authClient` (POST /auth/* on the Express/Prisma
  * server — see server/src/auth/routes.js).
  *
- * The shapes below (nextStep, signInStep, etc.) are a holdover from this
- * module's origin as a drop-in replacement for a Cognito-flavored auth SDK;
- * kept as local types since authSlice, Login, and Dashboard already consume
- * them.
+ * The shapes below (nextStep, signInStep, etc.) are a minimal auth-session
+ * stub for demo mode; kept as local types since authSlice, Login, and
+ * Dashboard already consume them.
  *
  * The API has no equivalent of email-verification or password-reset flows
  * (v1 has none). Where the contract expects a `nextStep`, those functions
@@ -79,7 +78,7 @@ interface ConfirmResetPasswordInput {
 }
 
 interface AuthSession {
-    tokens: { accessToken: { payload: { 'cognito:groups': string[] } } };
+    groups: string[];
 }
 
 let demoSignedIn = false;
@@ -177,13 +176,11 @@ export async function getCurrentUser(): Promise<AuthUser> {
 
 export async function fetchAuthSession(): Promise<AuthSession> {
     if (isDemoMode) {
-        return { tokens: { accessToken: { payload: { 'cognito:groups': ['admin'] } } } };
+        return { groups: ['admin'] };
     }
     const role = authClient.getStoredAuth()?.user.role;
     const groups = role === 'admin' ? ['admin'] : [];
-    return {
-        tokens: { accessToken: { payload: { 'cognito:groups': groups } } },
-    };
+    return { groups };
 }
 
 export async function signOut(): Promise<void> {
diff --git a/src/features/authSlice.ts b/src/features/authSlice.ts
index 8d9f175..2350584 100644
--- a/src/features/authSlice.ts
+++ b/src/features/authSlice.ts
@@ -33,9 +33,8 @@ export const checkSession = createAsyncThunk(
       const user = await getCurrentUser();
       const session = await fetchAuthSession();
 
-      // Check if user is admin (based on Cognito groups or custom attribute)
-      const groups = session.tokens?.accessToken?.payload['cognito:groups'] as string[] | undefined;
-      const isAdmin = groups?.includes('admin') ?? false;
+      // Check if user is admin (based on session groups or custom attribute)
+      const isAdmin = session.groups?.includes('admin') ?? false;
 
       return {
         email: user.signInDetails?.loginId || user.username,